Do captive portal apply to all web-browsing traffic or only to rules with user-id required?
cancel
Showing results for 
Search instead for 
Did you mean: 

Do captive portal apply to all web-browsing traffic or only to rules with user-id required?

L3 Networker

Hello,

I noticed that captiv portal is intercepting all web-brosing traffic, including traffic matching rules with userd-id required and rules without it.

Is there any solution to make some web-brosing traffic pass witghout beeing intercepted by the captive portal.

Regards.

1 ACCEPTED SOLUTION

Accepted Solutions

L5 Sessionator

The packet flow in the firewall hits Captive Portal before it hits a Security Policy. If the user-ID is unknown for a given IP address and the packet is destined for TCP/80, the PAN will perform a Captive Portal policy lookup to see if Captive Portal is applicable.  If so there will be a session redirect of the current packet to Captive Portal.  Once Captive Portal is invoked, there will be a Security Policy lookup and among the fields used will be the source user-ID  to verify if there is a security rule match.

View solution in original post

5 REPLIES 5

L5 Sessionator

You can verify you user mapping with the command >show user ip-user-mapping.  If he mapping looks good, those users should not be intercepted with Captive Portal.   The problem may be that users are logging into their workstations locally without logging into the domain, which would prevent the PanAgent from picking up  the login event from the AD. You may want to contact your support provider to verify your logs and configuration.

Thank you Rice,

But in my case, i was thinking that the matching of the captiv portal rule is conditioned by configuring user identification within security rules. So whene rules without user-id are matched, captive portal is not executed even if there is a captive portal rule with the same source and destination configured in the security rule. Is this true, or the captive portal is intercepting alla http traffic even if it pass throw a rule without user-id?

Regards

L5 Sessionator

The packet flow in the firewall hits Captive Portal before it hits a Security Policy. If the user-ID is unknown for a given IP address and the packet is destined for TCP/80, the PAN will perform a Captive Portal policy lookup to see if Captive Portal is applicable.  If so there will be a session redirect of the current packet to Captive Portal.  Once Captive Portal is invoked, there will be a Security Policy lookup and among the fields used will be the source user-ID  to verify if there is a security rule match.

View solution in original post

Ok,

So the solution to exculde some destinations from being intercepted by the captive portal, is to ad a captive portal rule in top of the captive portal rules and specify in source and destination those that i don't want to authenticate and specify "no captive portal" in the method?

Regards,

L5 Sessionator

Right, you'll specify the users you want excluded from Captive Portal under the Captive Portal rule.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!